GitHub Security: 6 Essential Settings

GitHub maintainers can dramatically improve their project's security posture by enabling just six free settings. These aren't a silver bullet against all threats, but they effectively close common vulnerabilities, making projects a much tougher target. According to the GitHub Blog, these settings are designed to be easily implemented, often in under an hour.

The first critical step is adding a SECURITY.md file. This document clearly communicates to researchers how to report vulnerabilities, preventing accidental public disclosure or the need to hunt down maintainer contact information.

Pairing this with private vulnerability reporting (PVR) offers a secure channel for bug disclosures. PVR allows researchers to file confidential advisories that maintainers can triage privately before deciding on a public disclosure timeline.

Stop Secrets Leaking

Secret scanning, especially with push protection, is vital. Recent reports indicate a significant increase in leaked secrets, including API keys and tokens, often exacerbated by AI-assisted commits. Push protection blocks these secrets from leaving a developer's local machine before they reach the repository, regardless of whether the repo is public or private.

Dependabot and dependency review are crucial for managing project dependencies. These tools alert maintainers to known vulnerabilities in packages and provide clear visibility into what's being added or updated in pull requests, transforming opaque dependency changes into manageable reviews.

Automated Code Analysis

Code scanning performs static analysis to detect common bug patterns like SQL injection and command injection. It also identifies insecure GitHub Actions workflows. GitHub's CodeQL engine, made free for open-source projects, offers a simple one-click setup that automatically selects appropriate queries for your project's language.

Finally, branch protection on the default branch is a foundational security measure. Requiring pull requests with at least one approval before merging prevents accidental merges of compromised code, confused contributions, or direct pushes to production. This setting also ensures that findings from other security tools, like Dependabot alerts and code scanning, actively block merges rather than being ignored.

GitHub simplifies the adoption of these measures through its 'Protect Your Project' wizard, a guided workflow that helps users enable these six settings in about 10-15 minutes per repository.